<html>
<head><meta charset="utf-8"><title>Packed structure UB concerns · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html">Packed structure UB concerns</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="217100044"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217100044" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tyson Nottingham <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217100044">(Nov 18 2020 at 06:17)</a>:</h4>
<p>I'm wondering about the UB concerns around using packed structures. Should I expect the <code>unaligned_references</code> and <code>safe_packed_borrows</code> lints to cover everything here? Are there other UB issues with respect to packed structures that the compiler won't detect?</p>
<p>For context: <a href="https://github.com/rust-lang/rust/pull/78646">https://github.com/rust-lang/rust/pull/78646</a></p>



<a name="217136482"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217136482" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oliver <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217136482">(Nov 18 2020 at 13:52)</a>:</h4>
<p>Is there anything you are suspicious of in particular?</p>



<a name="217136671"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217136671" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oliver <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217136671">(Nov 18 2020 at 13:53)</a>:</h4>
<p>afiak the main effect of <code>repr(packed)</code> is preventing padding of bytes in structs</p>



<a name="217146674"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217146674" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Nick12 <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217146674">(Nov 18 2020 at 15:09)</a>:</h4>
<p>afaik the only thing you need to worry about is references to unaligned fields (I think a reference to the packed struct should be fine, like ralf said here <a href="#narrow/stream/146229-wg-secure-code/topic/How.20do.20programmers.20use.20unsafe.20Rust.3F/near/211515950">https://rust-lang.zulipchat.com/#narrow/stream/146229-wg-secure-code/topic/How.20do.20programmers.20use.20unsafe.20Rust.3F/near/211515950</a> , but a reference to a field is where you can go wrong)<br>
I don't know if the clippy lints are perfect</p>



<a name="217160951"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217160951" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> oliver <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217160951">(Nov 18 2020 at 16:37)</a>:</h4>
<p>is that architecture dependent?</p>



<a name="217188593"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217188593" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tyson Nottingham <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217188593">(Nov 18 2020 at 19:59)</a>:</h4>
<p>These are rustc lints, FWIW, so I'm hoping that means they're more likely to be complete.</p>



<a name="217189661"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217189661" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217189661">(Nov 18 2020 at 20:07)</a>:</h4>
<p>They might be less effective than you're hoping since there wasn't a great workaround until relatively recently (<code>ptr::raw_const!</code> and friends).</p>
<p>Hopefully in a future edition we'll be able to upgrade some of this to hard errors...</p>



<a name="217191171"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217191171" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tyson Nottingham <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217191171">(Nov 18 2020 at 20:19)</a>:</h4>
<p>I see, thank you.</p>



<a name="217191234"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217191234" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tyson Nottingham <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217191234">(Nov 18 2020 at 20:20)</a>:</h4>
<p>Do we expect that the standard <code>#[derive]</code> implementations (<code>PartialOrd</code>, <code>Hash</code>,  <code>Debug</code>, etc.) correctly handle packed structs? Whether applied to packed struct or a struct containing one?</p>



<a name="217194083"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217194083" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217194083">(Nov 18 2020 at 20:44)</a>:</h4>
<p>A struct _containing_ a packed struct wouldn't be a problem, because the derives call the implementation on the field, not the subfields, and there's no safety concerns with references to the packed struct as a whole -- it's just a Size-N Align-1 type.</p>



<a name="217194121"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217194121" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217194121">(Nov 18 2020 at 20:44)</a>:</h4>
<p>The obvious way of implementing the derives would fail on a packed struct, though.</p>



<a name="217194182"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217194182" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217194182">(Nov 18 2020 at 20:45)</a>:</h4>
<p>Ah, yup:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="n">warning</span>: <span class="err">`</span><span class="cp">#[derive]</span><span class="err">`</span><span class="w"> </span><span class="n">can</span><span class="o">'</span><span class="na">t</span><span class="w"> </span><span class="n">be</span><span class="w"> </span><span class="n">used</span><span class="w"> </span><span class="n">on</span><span class="w"> </span><span class="n">a</span><span class="w"> </span><span class="err">`</span><span class="cp">#[repr(packed)]</span><span class="err">`</span><span class="w"> </span><span class="k">struct</span> <span class="nc">that</span><span class="w"> </span><span class="n">does</span><span class="w"> </span><span class="n">not</span><span class="w"> </span><span class="n">derive</span><span class="w"> </span><span class="nb">Copy</span><span class="w"> </span><span class="p">(</span><span class="n">error</span><span class="w"> </span><span class="n">E0133</span><span class="p">)</span><span class="w"></span>
<span class="w"> </span><span class="o">-</span>-&gt; <span class="nc">src</span><span class="o">/</span><span class="n">lib</span><span class="p">.</span><span class="n">rs</span>:<span class="mi">1</span>:<span class="mi">10</span><span class="w"></span>
<span class="w">  </span><span class="o">|</span><span class="w"></span>
<span class="mi">1</span><span class="w"> </span><span class="o">|</span><span class="w"> </span><span class="cp">#[derive(Hash)]</span><span class="w"></span>
<span class="w">  </span><span class="o">|</span><span class="w">          </span><span class="o">^^^^</span><span class="w"></span>
<span class="w">  </span><span class="o">|</span><span class="w"></span>
<span class="w">  </span><span class="o">=</span><span class="w"> </span><span class="n">note</span>: <span class="err">`</span><span class="cp">#[warn(safe_packed_borrows)]</span><span class="err">`</span><span class="w"> </span><span class="n">on</span><span class="w"> </span><span class="n">by</span><span class="w"> </span><span class="n">default</span><span class="w"></span>
<span class="w">  </span><span class="o">=</span><span class="w"> </span><span class="n">warning</span>: <span class="nc">this</span><span class="w"> </span><span class="n">was</span><span class="w"> </span><span class="n">previously</span><span class="w"> </span><span class="n">accepted</span><span class="w"> </span><span class="n">by</span><span class="w"> </span><span class="n">the</span><span class="w"> </span><span class="n">compiler</span><span class="w"> </span><span class="n">but</span><span class="w"> </span><span class="n">is</span><span class="w"> </span><span class="n">being</span><span class="w"> </span><span class="n">phased</span><span class="w"> </span><span class="n">out</span><span class="p">;</span><span class="w"> </span><span class="n">it</span><span class="w"> </span><span class="n">will</span><span class="w"> </span><span class="kr">become</span><span class="w"> </span><span class="n">a</span><span class="w"> </span><span class="n">hard</span><span class="w"> </span><span class="n">error</span><span class="w"> </span><span class="k">in</span><span class="w"> </span><span class="n">a</span><span class="w"> </span><span class="n">future</span><span class="w"> </span><span class="n">release</span><span class="o">!</span><span class="w"></span>
<span class="w">  </span><span class="o">=</span><span class="w"> </span><span class="n">note</span>: <span class="nc">for</span><span class="w"> </span><span class="n">more</span><span class="w"> </span><span class="n">information</span><span class="p">,</span><span class="w"> </span><span class="n">see</span><span class="w"> </span><span class="n">issue</span><span class="w"> </span><span class="err">#</span><span class="mi">46043</span><span class="w"> </span><span class="o">&lt;</span><span class="n">https</span>:<span class="c1">//github.com/rust-lang/rust/issues/46043&gt;</span>
</code></pre></div>



<a name="217194352"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217194352" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tyson Nottingham <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217194352">(Nov 18 2020 at 20:46)</a>:</h4>
<p>In this case the packed struct is <code>Copy</code>.</p>



<a name="217194654"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217194654" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217194654">(Nov 18 2020 at 20:49)</a>:</h4>
<p>That error suggests that possibly they're doing something smart for Copy+packed.</p>
<p>It would be awesome if you were to check that they're doing the right thing, and make a PR to mention that in their docs (such as <a href="https://doc.rust-lang.org/nightly/std/fmt/macro.Debug.html">https://doc.rust-lang.org/nightly/std/fmt/macro.Debug.html</a> )</p>



<a name="217207523"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217207523" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tyson Nottingham <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217207523">(Nov 18 2020 at 22:48)</a>:</h4>
<p>Thanks for the info everyone. I feel reasonably confident that <a href="https://github.com/rust-lang/rust/pull/78646">https://github.com/rust-lang/rust/pull/78646</a> is safe. Any comments on to confirm or deny would be appreciated. :)</p>



<a name="217503117"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed%20structure%20UB%20concerns/near/217503117" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns.html#217503117">(Nov 21 2020 at 14:04)</a>:</h4>
<p><span class="user-mention silent" data-user-id="125270">scottmcm</span> <a href="#narrow/stream/136281-t-lang.2Fwg-unsafe-code-guidelines/topic/Packed.20structure.20UB.20concerns/near/217194654">said</a>:</p>
<blockquote>
<p>That error suggests that possibly they're doing something smart for Copy+packed.</p>
<p>It would be awesome if you were to check that they're doing the right thing, and make a PR to mention that in their docs (such as <a href="https://doc.rust-lang.org/nightly/std/fmt/macro.Debug.html">https://doc.rust-lang.org/nightly/std/fmt/macro.Debug.html</a> )</p>
</blockquote>
<p>I haven't checked, but it is my understanding that (a) they are doing the right thing, (b) there'd be compiler errors if they did not (with these lints enabled) because the output of derive macros <em>is</em> at least unsafety-checked. (not sure if the <code>unaligned_references</code> lint checks them though.)</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>